Separate users and grants into separate resources